CVE-2023-22476

2023-02-2319:15:13

CWE-200

GitHub_M

web.nvd.nist.gov

mantisbt

mantis bug tracker

issue tracker

access-level checks

cve-2023-22476

security vulnerability

bug tracking software

nvd

patch

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

25.6%

JSON

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted bug_arr[] parameter in bug_actiongroup_ext.php. This issue is fixed in version 2.25.6. There are no workarounds.

Affected configurations

Nvd

Vulners

Node

mantisbtmantisbtRange<2.25.6

VendorProductVersionCPE
mantisbtmantisbt*cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mantisbt	mantisbt	*	cpe:2.3:a:mantisbt:mantisbt::::::::

CNA Affected

[
  {
    "vendor": "mantisbt",
    "product": "mantisbt",
    "versions": [
      {
        "version": "< 2.25.6",
        "status": "affected"
      }
    ]
  }
]